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■ Abstract 

> . 

q , BellQMA protocols are a subclass of multi-prover quantum Merlin- Arthur protocols in "which 

the verifier is restricted to perform nonadaptive, unentangled measurements on the quantum 
states received from each Merlin. In this paper, we prove that m-clause 3-SAT instances have 
BellQMA proofs of satisfiability with constant soundness gap, in which 0(y/m) Merlins each 
send O(logm) qubits to Arthur. Our result answers a question of Aaronson et al., who gave a 
protocol with similar parameters that used entangled measurements; the analysis of our protocol 
is significantly simpler than that of Aaronson ct al. Our result also complements recent work 
of Brandao, Christandl, and Yard, who showed upper bounds on the power of multi-prover 
quantum proofs with unentangled but adaptive (LOCC) measurements. 



1 Introduction 



In quantum Merlin-Arthur (QMA) proof systems, a computationally unbounded but untrusted 
^sD ! prover Merlin tries to convince a polynomial-time quantum verifier Arthur that a given statement 

is true, by sending to Arthur a quantum state as a "proof" . We desire that the protocol have two 
properties. The first is "completeness": if the statement is true, then there should exist a proof 
which makes Arthur accept with at least some high probability c. The second is "soundness": 
if the statement is false, then for any proof received, Arthur should accept with at most some 
lower probability s < c. In general, the complexity class QMA^ cs consists of all languages whose 
membership can be proved by a quantum Merlin-Arthur proof system using £-qubit proofs, with 
completeness c and soundness s. The complexity class QMA is defined to be QMA poly ( n ) j2 /3.i/3 
^ ■ where n is the input length. 

The generalized multi-prover version of QMA^ CS , denoted QMA(A;)£ iCjS , was introduced by 
Kobayashi, Matsumoto, and Yamakami in [KMY03] . In such a proof system, k Merlins are trying 
to convince a single Arthur that a given statement is true, by each sending Arthur a quantum 
state with I qubits, and these k states are assumed to be unentangled with each other. The class 
QMA(fc) is defined to be QMA(fc) poly(n)i2A i/3- 

One piece of evidence for the power of multiple quantum provers was given by Blier and 
Tapp [BT09], who showed that every language in NP has a 2-prover proof system with extremely 
short proofs, of t = O(logn) qubits each. Unfortunately, the soundness gap in their proof system 
(i.e., the quantity c — s) is very small: their protocol has c = l,s = 1 — 1/ poly(n). A related but 
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incomparable result was shown by Aaronson et al. [ABD+09] : they showed that m-clause 3-SAT 



instances can be proved satisfiable by a proof system using 0(y/m)) Merlins, each sending O(logm) 
bits, and with an improved soundness gap c = 1, s = 1 — 17(1). This still gives an almost-quadratic 
improvement in total proof length compared to known classical proofs, at least in the regime where 
the number n of variables satisfies n = O(m). 

A recent paper by Harrow and Montanaro [HM10] answers several important questions about 
QMA(fc). They prove that soundness amplification for QMA(/c) is possible and that QMA(A;) = 
QMA(2), for any k = 0(poly(n)). Building on the result of |ABD + 09] . Harrow and Montanaro 
also show that there exists a 2-prover proof system with proof length O(yjrn) for m-clause 3-SAT 
instances. 

In all results mentioned above, Arthur uses the so-called swap test measurement [BCWdWOl] as 
an important step in the protocol. This is an efficient method to test whether two unentangled states 
are approximately equal. A natural question thus arises: how crucial is the swap test to the power of 
multi-prover quantum proof systems? The swap test is an example of an entangled measurement, in 
which the states may become entangled by the measurement process; so more generally, how crucial 
are entangled measurements to these proof systems? To make such questions formal, }ABD + 09] 
defined the complexity classes LOCCQMA(/c) and BellQMA(fc). The class LOCCQMA(fc) consists 
of all languages whose membership can be proved by a /c-prover proof system where Arthur is 
constrained to make unentangled measurements on the states provided by the Merlins, but is 
allowed to make these measurements adaptively based on the outcome of previous measurements. 
BellQMA(/c) is the subclass of LOCCQMA(/c) in which we additionally require that no choice of 
measurement depends on the outcomes of other measurements. (For more precise definitions of 
LOCCQMA and BellQMA protocols, see Sec. CEO) Brandao |Bra08] showed that BellQMA(fc) = 
QMA for constant k. Quite recently Brandao, Christandl, and Yard [BCY10| made a breakthrough 
in the study of entanglement, and used their techniques to show that LOCCQMA(/c) = QMA for 
constant k. The situation for growing values of k remains unclear 

Our contribution. In this paper, we exhibit a BellQMA proof system for 3-SAT, which essen- 
tially matches the parameters of the earlier protocol of [ABD + 09] . Formally, we prove the following 
theorem: 

Theorem 1. There is a BellQMA proof system which, given a 3-SAT instance with m clauses, 
uses 0(y / m) Merlins, each of which sends O(iogm) qubits. The proof system has completeness 
1 — exp{— ri(-y/m)} and soundness 1 — £1(1). 

Our result shows that entangled measurement is not necessary for short proofs of membership 
in 3-SAT, and thus answers a question raised in [ABD + 09 Sec. 6.3]. Our system (just barely) loses 



perfect completeness as achieved by the protocol of ABD + 09] . but retains the constant soundness 



gap of that protocol. The analysis of our protocol is also significantly simpler than that of |ABD + 09 
which may be viewed as another contribution of this work. 

Our protocol also complements a negative result from [BCY10] (although our work was in- 
dependent of theirs). Corollary 5 of [B CY10] implies that if there exists a 2-prover LOCCQMA 



1 On the one hand, the ideas of HM10 rely on the swap test and do not apply to LOCCQMA and BellQMA. On 
the other hand, both the proof for BellQMA(fc) = QMA and that for LOCCQMA(fc) = QMA for constant k blow 
up the total length of the proofs to n cxp( - n ' fe - ) - ) , and thus cannot be used for k = u>(l). We can at least say that, if 
QMA(2) = QMA, then all classes here collapse to QMA. 
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protocol for 3-SAT with proof length o(y/m) and with constant soundness gap, then there exists a 
deterministic algorithm solving 3-SAT in sub exponential timell This result seems to pose a signifi- 
cant barrier to achieving shorter proof length using unentangled measurements. Our positive result 
nearly reaches this barrier, except for the fact that we use more than 2 provers. If our protocol 
could be converted to a 2-prover BellQMA or LOCCQMA protocol with similar proof length, then 
(under the plausible assumption that 3-SAT requires exponential time) we would obtain a nearly 
tight understanding of the power of these restricted quantum proof systems for 3-SAT (and of many 
other NP languages, via standard reductions). 

Our Techniques. The construction of our proof system, which we sketch next, adapts techniques 
used by Blier and Tapp in their proof system for 3-colorability from [BT09], and combines them 
with sampling and PCP ideas similar to those used by Aaronson et al. [A BD + 09j . In the Blier- Tapp 
protocol, Arthur receives two states l^ 1 ), j^ 2 ) of form 

\* i ) = Y,<M c )> * = 1,2, 

v,c 

where v £ {0, 1, . . . , n — 1} indexes a vertex in a graph G to be properly 3-colored and c S {0, 1, 2} 
is a color for v. The protocol randomly performs one of three tests on l^ 1 ), l^ 2 ): 

• An "Equality Test" uses the swap test to check that l^ 1 ), \^ 2 ) are nearly equal. This is the 
only entangled measurement. 

• A "Uniformity Test" uses the quantum Fourier transform to check that each state has am- 
plitudes which are almost uniformly spread over the n vertices. 

• A "Consistency Test" directly measures the vertex and color registers on each proof, rejecting 
if it sees two adjacent vertices with the same color or two differently-colored copies of the 
same vertex. 

This proof is extremely succinct — only two states of logn qubits each — but as mentioned, its 
soundness gap is only inverse-polynomial in n. IntuitiveljH this is because, if the Merlins send 
proofs uniformly spread over the vertices, each equipped with a coloring violating only one edge 
constraint, then the Consistency test can only succeed if the two vertices sampled come from this 
edge, which happens with probability 2/n 2 . 

We modify this protocol as follows. First, we ask for 0{yjn) proofs instead of 2. The "birthday 
paradox" then ensures that the Consistency Test will turn up pairs of equal vertices. These will 
cause rejection unless almost all vertices are nearly- unanimous in their colorings across the supplied 
proofs. With this added assurance, we simply omit the Equality Test. Our modified Uniformity 
Test ensures that there are enough states in which the amplitudes are almost uniformly spread 

2 This is not quite made explicit in IBCYlOj . so we elaborate. [BCYlOl Corollary 5] gives an explicit construction of 
certain mappin gs called "a pproximate disentanglers" (for LOCC measurements). Following the use of such mappings 
as described in [ABD + 09] (where they were defined), a 2-prover LOCCQMA proof system for 3-SAT of proof length 
o( v / m) would imply a single- prover QMA protocol for 3-SAT of proof length I — o(m). The maximum acceptance 
probability of such a protocol can be approximately determined using semidefinite-programming solvers in time 
poly(2 f ) = 2 o(m) . 

3 The actual soundness gap shown in 'I i l l)!) is fi(n -6 ), even worse than our sketch would suggest; this was 
improved to Sl(n _3_e ) by Beigi in |BeilO) by a modified protocol that still uses two 0(logn)-sized proofs, but loses 
perfect completeness. 
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over the vertices, although to improve the soundness of this test, we are forced to sacrifice perfect 
completeness. 

In the Consistency Test, we now also expect to sample pairs of vertices adjacent in G. However, 
this will only lead to rejection with noticeable probability if the constraint problem is "highly 
unsatisfiable" , in the sense that every coloring violates an 0(1) fraction of the edge constraints. To 
ensure this, we apply the size-efficient PCP reduction of Dinur [Din07| to our original 3-coloring 
problem (or 3-SAT instance), which incurs only a polylogarithmic blowup in the instance size. This 
completes the sketch of our protocol and the basic ideas of the analysis; the full proof of correctness 
is slightly more involved. 

Open Problems. Some questions raise from our result and those mentioned above. The most 
immediate one is whether the number of provers in our system can be further reduced without 
expanding the total proof length much. In particular, is there a 2-prover LOCCQMA proof for 
3-SAT with length 0{y/m)l As we discussed earlier, if 3-SAT requires exponential time, this would 
be a nearly tight result in terms of proof length. Whether general 2-prover protocols can achieve 
even shorter proofs of satisfiability remains an interesting question. 

It also seems promising to see whether the entanglement theory ideas of [BCY10] can be ex- 
tended to give a fuller understanding of entanglement between more than 2 quantum states. As just 
one benefit, this could yield new information about the power of LOCCQMA(/c) and BellQMA(A;) 
for superconstant k. 

2 Preliminaries 

We assume familiarity with (uniform) polynomial-time quantum algorithms. Such algorithms are 
describable by a polynomial-size quantum circuit with polynomially many auxiliary qubits; the 
circuit is required to be constructible by a classical logarithmic-space algorithm. 

2.1 BellQMA and LOCCQMA protocols 

We now more formally define the restricted multi-prover proof systems called BellQMA and LOCC- 
QMA protocols. The complexity classes BellQMA(A;), LOCCQMA(fc) are defined in perfect analogy 
with QMA(/c), using these restricted protocolso In BellQMA protocols, Arthur performs a so-called 
"Bell test" upon the quantum proofs; in LOCCQMA protocols, Arthur performs a test involving 
only "local operations and classical communication" (LOCC) upon the proofs. This motivates the 
terminology. 

Our definition of BellQMA protocols is slightly broader than that given in [Bra08], and we 
discuss the difference below. The more general class of LOCCQMA protocols will not be important 
in this paper, but we choose to provide a definition since previous discussions presume familiarity 
with the framework of LOCC tests (see [BBPS961 lNie99] ). 

In a /c-prover QMA protocol, the verifier (Arthur) receives a classical input x S {0, l} n , as 
well as k "proof states • • • , \^k) from k provers (Merlins). The k proofs are required to 
be unentangled. Arthur performs some quantum-polynomial time test on the proofs, after which 
he either accepts or rejects. We say that a QMA protocol for a language L C {0, 1}* possesses 
completeness c and soundness s < c if: 

4 In [BCY10| . the notations QMA L0 (fc) = BellQMA(fc) and QMA L0CC (fc) = LOCCQMA(fc) are used. 
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1. If x G L, some collection . . . , |\Pfc) causes Arthur to accept with probability at least c; 

2. If x ^ L, any collection |\I/i), . . . , causes Arthur to accept with probability at most s. 

In a Approver BellQMA protocol, we restrict the form of Arthur's test as follows: Arthur first 
performs a polynomial-time quantum computation on x alone. The workspace is then measured 
fully, yielding a description of measurements Mi, . . . , M*. described by polynomial-size quantum 
circuits; the i-th measurement, which may output more than one bit, is required to act locally on 
the i-th proof. The measurements are then performed, and we let y\ denote the output of the i-th 
measurement. Finally, Arthur performs a quantum polynomial-time computation on (x, y%, . . . , y^) 
to decide whether to accept or reject. 

Since the measurements M\ , . . . , M& are fully determined by the intermediate measurement 
and act separately on the k unentangled proof states, the proof states remain unentangled after 
the Mi are performed. A second observation about BellQMA protocols is that the identities of 
the measurements Mi, . . . , M/% can be random variables, and these random variables need not be 
independent El 

In |ABD+09| . the definition of BellQMA protocols was informal and slightly ambiguous. In 
Brandao's thesis [Bra08], the definition of BellQMA protocols required the final computation on 
(x, yi, . . . , yk) to be performed by a classical polynomial-time algorithm. We feel that, since Arthur 
is allowed to use arbitrary polynomial-time quantum measurements Mj on the k proofs, it is nat- 
ural to allow polynomial-time quantum computations in the final stage. Indeed, Brandao's proof 
in [BraO^ that BellQMA(A;) = BellQMA works equally well if this final computation is allowed to 
be quantum. The BellQMA protocol that we give in this paper actually obeys Brandao's more 
restrictive definition. 

In LOCCQMA protocols, Arthur is allowed to repeatedly and adaptively choose measurements 
to perform on the proofs. However, these measurements are required to act locally on a single proof 
state, and they must be performed when Arthur's workspace is in a computational basis state. This 
forces the proofs to remain unentangled throughout the computation. 

Formally, /c-prover LOCCQMA protocols can be defined as follows. Arthur's verification al- 
gorithm consists of a polynomial number p(n) of stages. Each stage t < p(n) has the following 
form: 

1. Arthur first performs a polynomial-time quantum computation acting on his workspace qubits 
alone. Arthur's full workspace is then measured, yielding a tuple (it,M t ,z t ). Here M t de- 
scribes a polynomial-time quantum measurement to be performed locally on the ij-th proof, 
and Zt is an auxiliary memory string. 

2. Mt is then performed, yielding an outcome yt of one or more bits. Arthur then begins the 
(t + l)-st stage with his workspace initialized to the computational basis state \yt, z t ). 

Finally, Arthur accepts or rejects based upon the first bit of y p r n y We remark that Arthur is 
allowed to measure individual proof states more than once. 

Note that BellQMA protocols can be defined as LOCCQMA protocols in which all measurements 
to be performed on the k proof states are determined in the first computation phase and described 
by the string z%, then nonadaptively performed in the following phases. 

5 In our protocol, the measurements will be chosen in a dependent fashion; however, it is not hard to modify our 
protocol to make these choices independent (for a fixed input x), with only a constant-factor increase in the number 
of provers. 
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2.2 Dinur's PCP reduction 



The recent version of the PCP Theorem given by Dinur [Din07] is a reduction from the Boolean 
Satisfiability problem to a so-called constraint graph problem, or 2-CSP. A constraint graph is 
an undirected graph (possibly with self-loops) along with a set £ of "colors". For each edge 
e = (u,v) G E the constraint graph has an associated constraint R e : £ x £ — > {0, 1}. A coloring 
r : V — > £ satisfies the constraint i? e if R £ (t(u),t(v)) = 1. We say that G is satisfiable if there 
exists a mapping r that satisfies all constraints. We say that G is (1 — r/)-unsatisfiable if for all 
mappings r : V — > £, the fraction of constraints satisfied by r is at most (1 — r/). 



Theorem 2. [DinOl, Thm. 8.1 and its proof] There exists a reduction T from 3-SAT instances to 



2-CSP instances, with the following properties: 



1. Completeness: If (p is a satisfiable formula, T((p) is a satisfiable 2-CSP instance; 

2. Soundness: There exists an absolute constant r\ > such that if ip is unatisfiable, G = T(<p) 
is (1 — rj)-unsatisfiable; 

3. Size- Efficiency: If ip has m clauses, then \V(G)\ = n = 0(m ■ polylogm) and also \E(G)\ = 
0(m ■ polylogm); 

4. Alphabet Size: |S| = K = O(l); 

5. Regularity: G is d-regular (with self-loops), where d = O(l). 

The last point is not quite explicit in the main statement of Dinur's result, but can be readily 
extracted from her proof: simply apply the "preprocessing" transformation of [Din07t Lemma 1.9] 
to the graph output by her main reduction. Also, Dinur's main reduction takes as input a constraint 
graph, not a formula, but we can simply begin by transforming any 3-SAT instance of m clauses 
into an equivalent instance of an NP-hard 2-CSP such as 3-Colorability, yielding a constraint graph 
whose number of edges is 0(m). 

In our protocol, Arthur first performs the above reduction, yielding a 2-CSP G on n = 0(m) 
vertices that is either satisfiable or (1 — ry)-unsatisfiable. We now describe our BellQMA protocol 
for the problem, starting directly from the constraint graph G. 



3 The BellQMA protocol 

Given a constraint graph G, let the proof states Arthur receives be denoted l^i), . . . , \ ^c^n)^ w hh 
C a constant (to be determined later). Each consists of a "vertex" register with base states 
|0), . . . , \n— 1) (describable by [logn] qubits) and a "color" register with base states |0), . . . , \K— 1) 
(describable with [log if] = Oil) qubits). Let \i = Cy/n/K. The verifier's protocol is given below. 

Verifier V: 

• Flip a fair coin. If Heads, do the Uniformity Test; if Tails, do the Consistency Test. 

• Uniformity Test: 
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1. For each perform a Fourier transform Fx on the color register and measure it. 
Let Z = {i : the color register of is measured 0}. If \Z\ < Wfj, reject; otherwise 
continue. 

2. For each such that the measurement in Step 1 gets 0, perform a Fourier transform 
F n on the vertex register and measure it. If there exits a such that the measurement 
doesn't get 0, reject; otherwise accept. 

• Consistency Test: 

1. For each measure it and denote the value in the two registers as {v- L , Cj). 

2. If there exists two states Y$>i) and such that e = (vi,Vj) 6 E but R e (ci,Cj) = 0, 
reject. Also reject if Vi = Vj but o L ^ Cj. Otherwise, accept. 

Note that, since n = 0(m), we have 0{m) proofs, each consisting of logn + O(l) = O(logm) 
qubits, as needed. The verifier is clearly polynomial-time and performs only nonadaptive, unen- 
tangled measurements, so it defines a valid BellQMA protocol. 



3.1 Completeness of our protocol 

In the rest of the paper, we use i to denote the square root of —1, and reserve the symbol i as 
an index of states sent by the provers. We first consider the case where the 3-SAT instance ip is 
satisfiable, so that the constraint graph G is also satisfiable. 



Lemma 1. If G is satisfiable, then there exist (unentangled) states ■ ■ ■ , |W C such that V 
accepts with probability at least 1 — exp (— /i/(2 • 10 4 )) = 1 — exp (—Q(^/m)) . 

Proof. Let |^) = = ^ E"=o H l r ( u )) for a11 * ^ C Vn, where r is a coloring satisfying the 
constraint graph G. Since r is satisfying, the Consistency Test will accept with probability 1. Below 
we analyze the probability that the Uniformity Test will accept if that test is performed. 
Observe that a Fourier transform on the color register changes l^) into 



71-1 , 71-1 -, K-l 

,\ k )- W 

v=0 v '" v=0 v xv fc=0 



(2-Kir{v)k 



Therefore for each the measurement in Step 1 of the Uniformity Test will see with probability 
n(l/^/n) 2 (l/\/K) 2 = l/K. Accordingly, E[|Z|] = C^/n/K = fx. Since the |*i)'s are unentangled, 
their measurement outcomes are independent. By a Chernoff bound, the probability that the 
Uniformity Test passes Step 1 is 



1 -Pr 



\z\<**a 

1 100 



> 1 — exp 



2 • 10 4 



Further notice that according to Eq. [TJ conditioned on the color register measuring to in Step 1 
of the Uniformity Test, the state in the vertex register of |^) becomes Y^v=o I 77 )' an< ^ a Fourier 
transform F n will change this state into 

F n — v ) = ~r E ~r E ex P u = • 
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Thus for each which is measured in Step 1 of the Uniformity Test, Step 2 of this test will 
measure with probability 1. Accordingly, if the Uniformity Test passes Step 1, it will accept in 
Step 2 with probability 1. 

Thus the probability that V accepts is at least 

r i 1 ~ 2exp (-2-i(F)) • 1 + r 1 = 1 " exp (-2-i(F) • 

□ 



4 Soundness of our protocol 



Now we consider the case where the 3-SAT instance ip is unsatisfiable, so that the constraint graph 
G is (1 — ry)-unsatisfiable. We show that for any sequence of proof states . . . , \^cJn)i V wn l 



reject with probability 0(1) . The proof depends on three lemmas, corresponding to three cases 
that cover all possible sequences of states sent by the Merlins. 

First, we can assume without loss of generality that the states Arthur receives are pure states, 
since by convexity some sequence of pure states maximizes Arthur's acceptance probability. For 
each i G [C^\, we can express as 



71— 1 



K-l 



where YZ=l \ a 



J 1 2 



v=0 



1 for each i, and Yl*j=o \P l v 



3=0 



1 for each i, v. 



Let Pq be the probability that the color register of is measured after the Fourier transform 
in Step 1 of the Uniformity Test (conditioned on our performing that test). Let 



7/ a 



4K 



We claim: 



Lemma 2. If\Z'\ < then Step 1 of the Uniformity Test rejects with probability 0(1). 

Proof. Let Z x = Z n Z' and Z 2 = Z \ Z' . We have \Z X \ < \Z'\ < n/2, and Pr[i G Z 2 \ < l/(4K) 
independently for every i G [C^/n\ . Let W be a random subset of [Cy/n\ such that Pr[i G 
W] = 1/(4K) independently for every i. Then \W\ stochastically dominates \Z 2 1 and we have 
E[|1U|] = CyfnjiAK) = n/A. The probability that Step 1 of the Uniformity Test accepts is 



Pr 



\Z\ > 



99// 

Too 



Pr 



< Pr 



< Pr 



< exp 



\Zi\ + \Z 2 



~ 2 4 100 



\z 2 \>» + 2 -^ 

1 1 ~ 4 100 

\w\>» + 2 -^ 

1 1 " 4 100 



242 M , , p 
-25^2-4 I =0(1) ' 



where we used a Chernoff bound. 



□ 
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Let e < 7^/20 be a constant (recall that n is the soundness constant in Dinur's PCP reduction), 
and for each i G [C^/n], let 

Ri = {v : v G V, \al\ 2 < l/(8Kn)}. 

The next lemma considers the case where one of the sets Ri is noticeably large. 

Lemma 3. Suppose there exists i G Z' such that \R{\ > en. Then the Uniformity Test rejects with 
probability $7(1). 

Proof. We focus on any such index i. After the Fourier transform on the color register in Step 1 of 
the Uniformity Test, becomes the state defined by 



n-l 



K-l 



n-l 



K-l 



1 



K-l 



(i n ® f k ) «» R>*\i) = 12 a >> Yl fij-fw ^ exp 

v K k=n \ 



I 27rijk \ 



v=0 
K-l I n-l 



3=0 
' K-l 



exp 



v=0 j=0 
I 2nijk 



K 



k=0 \v=0 



,=0 



V K 



v) \k). 



(2) 



Let 1 7) = Ylv=o lv\ v ) w ith Y^v=o ItS 1 2 = 1 be the state left in the vertex register of after 
conditioning on the color register of measuring to 0, which occurs with probability p l by 
definition. For each v G {0, 1, . . . , n — 1}, let Pq^ be the probability that the color register of |3>j) 
is measured and the vertex register of is measured v. We have that 



pi _ „i . ui|2 



On the other hand, by Eq. [2] we have 



P, 



0,u 



K-l 



• v i=o 



i 1 2 



K-l 
J=0 



J=0 



•I 2 = laN 2 



where we used the Cauchy-Schwarz inequality and the fact that ^2,f = Q = 1- Combining 

the above two equations, we find p l Q ■ |7*| 2 < \a l v \ 2 . Because i G Z', we have Pq > 1/(4 A). Thus 
I t£| 2 < 4A|a£,| 2 for each u. Accordingly, for each v ^ Ri, 

4A 1 



l7^| 2 < 



Define 



8An 2ra 



v=0 



For each t> G Ri, |-y* - 1/y 7 ™! 2 > (l/v 7 ^ - 1/a/^I 2 = (1 — l/V2) 2 /n. Then, using unitarity of F n , 
we have 



l^n|7)-|0)||| = |||7> 



I > £ (1 - l/\/2) 2 /n > en ■ (1 - l/v^/n, = 0(1). 



veRi 



Since ||A n |7)||2 = 1, it follows that the amplitude of |0) in F n |7) is of norm < 1 — 0(1). Thus if the 
color register of measures in the Uniformity Test (as happens with probability p l Q > 1/(4A) 
since i G Z'), the vertex register measures to some v 7^ with probability 0(1). The Uniformity 
Test's rejection probability is therefore 0(1/A) = 0(1) as claimed. □ 
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In light of Lemmas [2] and [3l we need only to address the case when \Z'\ > fi/2 and \Ri\ < en 
for all i G Z' . We show that in this case, the Consistency Test rejects with probability 17(1). 

Consider an arbitrary state index i £ Z' . Let Di denote the distribution on vertex/color 
pairs when is measured by the Consistency Test. We can equivalently generate each Di as 
Di = gi(Ui), where each Ui is a uniform, independent value from [0, 1], and gi : [0, 1] — > V(G) x £ 
is a function such that each preimage g~ l ((v,c)) is an interval of length equal to Pr[Dj = (v, c)]. 
Then for each v ^ Ri, the set g^ 1 ^,*) is of measure \a l v I 2 > l/{8Kn). Select J i>v C ^(t,,*) of 
measure exactly l/(8Kn) for each such t>, and let Jj = \J v ^r. Ji,v- Observe the following: first, Jj 
has measure greater than (1 — e)/(8K). Second, conditioned on Ui G Jj, the posterior distribution 
of the vertex Vi that gi outputs is now uniform over Si = {0,1, ... ,n — 1}\ Ri. 

So let us consider the Consistency Test applied to a sequence of states satisfying \Z'\ > u/2 
and \Ri\ < en for all i G Z' . Letting the measurement outcomes be generated as described above, 
define the random set 

Z" = {i : i G Z',Ui G Ji}. 

Notice that Z" is itself a random variable determined by the U^s. Notice also that for each i G Z' , 
the probability that i G Z" is at least (1 — e)/(8K), and these events are independent from each 
other. Therefore we have that 

(l-e)|Z'| (l-e)u _ (l~£KVn 
|j > 8R > - 16R2 . 

Since \Z"\ never exceeds Cy/n, the total number of proof states, we find that with probability 0(1), 

1*1 > (3) 

The following lemma tells us that if C is chosen as a suitably large constant, then conditioned on 
Eq. [3] holding, the Consistency Test rejects with 0(1) probability. 

Lemma 4. Let (G,{R e }) be an n-vertex, d-regular constraint graph (possibly with self-loops, and 
d > 1 ) with alphabet K, such that G is (1 — rj)-unsatisfiable. Let D\, . . . D m i be independent 
distributions on V(G) x S, with (uj,Cj) denoting the output of Di. Suppose for each i < m' there 
exists an Si C V(G) of size at least (1 — e)n, such that Vi is uniformly distributed over Si, where 
e < 77/2O. 

Then we can set m! = 0(y/n) large enough so that with probability at least .99 there exists 
i < j < m! such that: either e = [vi,Vj) is an edge of G and R e (ci,Cj) = 0; or Vi = Vj,a ^ Cj. 
(The constant in the 0() notation depends on d and 77, but not K.) 

To apply Lemma S] to our Consistency Test when \Z'\ > fi/2 and \Ri\ < en for all % G Z' , 
choose C = 0(1) such that C 'y/n / '(32K 2 ) > mf. Then conditioned on \Z"\ > ml ', which occurs with 
probability 0(1), we can select D\, . . . , D m i from the distributions of l^^'s (when measured in the 
Consistent Test) such that i G Z" . By definition of Z" , these D\,... ,D m i satisfy the hypothesis 
of Lemma HI so the Consistency Test rejects with probability .99. Thus in this case V also rejects 
with probability 0(1). This completes the proof that V possesses soundness 1 — 0(1), proving 
Theorem [TJ 

Proof of Lemma\J^ For i < j < m! , let Vij be the indicator random variable for the event that 
either e = (vi,vj) G E(G) and R e (ci,cj) = 0, or Vi = Vj and 7^ Cj. Let V = J2i<jVi,j- To 
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prove Lemma S] it is enough to show that Pr[V = 0] < .01. We show this using the second moment 
method. 

A first observation is that we can generate Di in the following way: first, randomly select a 
coloring Tj according to some distribution Hf, next select uniformly from Si, and set c, = Ti(-Uj). 
To be explicit, each Hi independently chooses colors according to the rule Pr[rj(t>) = c] = Pr[Q = 
c\vi = v]. It is easily verified that this process yields Di. 

Next we lower-bound E[V] = Y2i<j ^[^m']- Fix any pair 1 < i < j < m'. Condition on any 
values of the colorings Tj , Tj j we'll show that E[Vjj|Tj, r 3 -] > e/n. Let Pjj C V(G) be the subset of 
vertices v for which Ti{v) = Tj(v). Suppose first that \P%j\ < (1 — 3e)n. In this case there are at 
least en vertices contained in Si Pi Sj D Pjj, and Vjj = 1 whenever a vertex in this set is selected as 
both Vi and Vj. Thus in this case E[Vjj|Tj, Tj] > en ■ \Si\~ 1 ■ |5j| _1 > e/n. 

For our second case, suppose \Pij\ > (1 — 3e)n. Consider the induced subgraph G[SinSjnPij], 
which contains at least n — 2en — 3en = (1 — 5e)n vertices. Since G has maximum degree d, 
\E(G)\ = dn/2, and the set Si U Sj U Pjj is incident on at most d(5en) edges, we have that 
| J B(G[5' i n5 i nP iJ ])| > dn/2-5den = (l-10e)(dn)/2 = (1 - 10e)|£(G)|. By (l-^-unsatisfiability 
of (G, {i? e }), the coloring r, satisfies at most a (1 — 77) / (1 — lOe) fraction of the edge constraints 
in G[Si n Sj n Pj,j]- Thus the fraction of these constraints which are violated by Tj is at least 

1 j— 5 — 1 ~ 10e ~( 1 ~ r ?) -> U \ «infP n 9iv 
1 T^lOe - l=10i > 2(l-10e) > 2' S1I1Ce ^ > ^ U£ - 

Now Tj = Ti on Pjj. We can thus lower-bound E[Vjj|Tj, Tj] by the probability that Vi,Vj 6 
<Sj n Sj n Pjj and that form (in either order) an edge violated by the color assignment 

{ T i( v i)i T j( v j))- Note that some edges are self-loops and so may only be chosen in one way. We get 

Wi,i\n,Tj\ > 1 - 5e 2 • 21 v 1 J ^ 

> 2 7/(1 - 10gMG)j _ 7?(1 - 5e) 2 (l - 10e)d 

~ 1 ; 2n 2 An 

Recall that e < n/20 < 1/20, so the quantity above is greater than n ■ 2 _3 d/4ra > n/(20n) > e/n, 
as needed (using d > 1). Thus in either of our two cases we conclude E[Vj j|Tj, Tj] > e/n, so 
E[Vij] > e/n unconditioned as well. Summing over all i < j, we find E[V] > e(™ )/n = f2 ((ra') 2 /n) . 

Next we upper- bound E[V 2 ] = Y,i<j,k<l E i V i,j V k,l\- There are (™ ) terms for which = (k,l). 
For each such term E[T^ 2 -] = E[Vjj]. Condition on the vertex Vi outputted by Di. Fixing any such 
choice of Vi, the probability that Vij = 1 is of course upper-bounded by the probability that Vj is 
equal or adjacent to «j in G. Since Vj is uniform on Sj and Vi is of degree d, this probability is at 
most (d + < (d + 1)/((1 — e)n), so E[Vjj|uj] < (d + 1)/((1 — e)n). As Uj was an arbitrary 

conditioning, we conclude E[V»j] < (d + 1)/((1 — e)n). Thus the contribution to E[y 2 ] from terms 
where (i, j) = (k, I) is at most (™') (d + 1)/((1 - e)n) = O ((m') 2 /n) . 

If (fc, l) consists of three distinct indices, assume that j = I, the other cases being handled 
similarly. Condition on any choice of Vj. Then VijVj^ = 1 can only occur if Vj and are each 
either incident on or equal to «j. These two events are independent after conditioning on Vj since 
Di, Dj,D k are independent. Thus E[V id V k j] < [(d + 1)/((1 - e)n)} 2 . 

For any three distinct indices a < b < c < m! , there are six tuples (i < j), (k < I) for 
which {i,j,k,l} = {a,b,c}. Thus the contribution to E[F 2 ] from these "triplet" terms is at most 
6(f) • [(d +!)/((! -e)n)] 2 = 0{{m'f/n 2 ). 
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If (k, I) are four distinct elements of [m'], then the pair V%,j, Vj t k depend on disjoint sets of 
independent random variables, so that EfV^jV^;] = E[V»j]E[Vfc j]. Thus the contribution to E[F 2 ] 
from these terms is upper-bounded by Si<j fc<j^[^j]^[^fc,i] = ^[^] 2 - 

Putting things together, 



E[V 2 } < O ( + ) + E\Vf 

n n z 



With this bound in hand, we apply Chebyshev's inequality: 

Pv[V = 0] < Pr [\V - E[V]\ > E[V)] 
E [V 2 ] - E[V} 2 



< 



E[V] 



2 



n 2 ( (m 1 ) 2 (m') 3 



'm') 4 V n n 2 



^ ( n 1 

which is at most .01 if we take ml to be a suitably large value in 0{y/n). This proves the lemma. □ 
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